What it does
Every archiver makes files smaller. Almost none of them hide what the files are called, or prove nothing changed.
- What it is
- A free, open-source file archiver for Windows, written in Rust.
- What it does
- Compresses a folder, encrypts the contents and the file names, and seals the archive so anyone can prove nothing changed.
- Who makes it
- Bill Corbitt, a digital forensic examiner with 35 years in the field, for Veteran Fathers 501, a 501(c)(3) public charity.
- Price
- Free. Every shipped feature, no licence key, no trial, no advertising, no telemetry.
- Licence
- AGPL-3.0-or-later.
- Platform
- Windows 10 and 11, 64-bit. Version 0.1.0-dev, pre-release.
- Formats
- Writes .z501, .z501x, .zip and .tar.zst. Reads zip, tar, gz, xz, zst, 7z and rar.
Proven
A BLAKE3 seal covers the whole archive, and every file carries its own hash inside the sealed index. Verifying needs no password at all. One flipped byte fails the check.
Test and verify work on native.z501 and .z501x archives. Zip, tar, 7z and rar get extract and list.
Private
XChaCha20-Poly1305 encrypts the payload and the filenames and metadata with it. Argon2id turns your password into a key. Classic ZIP encryption leaves the names readable; .z501x does not.
Smaller
zstd with FastCDC deduplication, and already-compressed files are stored as-is instead of squeezed twice. On the part of a folder that can actually shrink, we measured about 21:1.
On mixed data the margin over ZIP is a few percent, and 7-Zip is smaller still. The full table is below.
Why it exists
I have spent 35 years proving what happened to other people's data.
Somewhere along the way I noticed that the tool everyone uses to hand that evidence around was designed before most of my team was born, and that it kept turning up on the exploited-vulnerabilities list.
So I built the archiver I wished existed. Encrypted down to the filenames. Sealed so that anyone — a lawyer, a judge, a parent — can prove nothing changed, without ever needing the password. The code is public, so you do not have to take my word for any of it, and the benchmark corpus is in the repository so you can re-run the numbers yourself.
Here is the part that matters more to me. There are two shelters in this country that will take in a father and his children escaping abuse, and there are none east of the Mississippi. Veteran Fathers 501 is working to change that, and this tool is one of the ways we get there.
Bill Corbitt, Lead Developer & Mad Scientist
Get it
Download, then prove the download.
Windows installer
Version 0.1.0-dev · pre-release · Windows 10/11 64-bit · registers the Explorer right-click verbs. On Windows 11 they live under “Show more options” for now.
SmartScreen will warn you
The installer is not signed yet — an EV certificate is a 1.0 item. Rather than ask you to ignore the warning, here is the hash so you can check the file yourself.
SHA-256 [SHA-256 published with the first public release]Run this in PowerShell and compare:
Get-FileHash .\[installer-file-name].msi -Algorithm SHA256
A free, open-source archiver for Windows. Rust. Compress, encrypt, and prove.
Bugs and questions go to GitHub Issues. Security reports go to info@intersecworldwide.com — please do not open a public issue for a hole. The Intersec breach hotline is for active incidents only and is not Z501 support.
Building from source: cargo build --release
Want to know when a security fix ships?
Entirely optional, and the download does not wait on it. We will email you when a Z501 release or security advisory goes out, and for nothing else unless you ask.
Get release noticesNo account, no licence key, no tracking in the software itself. What we send and why.
For examiners
What it keeps, and what it does not.
Evidence moves between examiner, counsel, insurer and court on drives and in zip files. Z501 keeps what the next person needs in order to trust it — and publishes the gaps in the same table, because the gaps are what you will be asked about.
| Kept in every archive | Detail |
|---|---|
| Filename and size | Per file, with the directory structure |
| Modified / Accessed / Birth | 100 nanoseconds, restored on extract when you ask for it |
| NTFS Change time | 100 nanoseconds, captured. Not restorable by any user-mode API, and we say so rather than imply otherwise |
| Per-file BLAKE3 | In the sealed index, verified on extract |
| Root BLAKE3 seal | Over the whole archive. Verifying needs no password |
| Plaso JSONL timeline | Exported on demand |
| Examiner sidecar | Case, evidence, examiner and notes as .md and .json. Unsigned — if the sidecar and the archive disagree, the archive wins |
Not packed in this version — planned, not pretended: alternate data streams, owner and ACL security descriptors, USN journal numbers, extended attributes, $FILE_NAME timestamps, hard-link paths, and Volume Shadow Copies. Files larger than 16 GiB are refused. Archives written in the older 0x0002–0x0005 formats will not open; rebuild them with this version.
Z501 is a logical evidence archive, comparable in purpose to an L01 or AD1. It is not a disk image and does not replace your imager. Image the drive with your imager; move and prove the file set with Z501. If you need the imaging and the analysis done for you, that is what our digital forensics team does.
Why now
Built after the archiver flaws of 2023–2025.
In 2025 a WinRAR flaw let a crafted archive drop files into the Windows Startup folder through alternate data streams, and was exploited in the wild. A 7-Zip flaw let extracted files skip the Mark-of-the-Web warning. Archive openers have become one of the favourite ways in. Z501 was written with that history in front of us:
The RAR opener runs in a cage
UnRAR's C++ never runs in the window you clicked. It runs in a separate child process inside a Windows Job Object that dies with the parent, cannot exceed 2 GiB, and times out.
One gate for every format
Paths canonicalised against the destination. Alternate-data-stream names rejected. Junctions and reparse points rejected. .. rejected rather than stripped. Size, entry-count and ratio limits. Z501 never writes a symlink, from any format.
Written in Rust
The only unsafe code is Windows FFI — the sandbox and three API calls — each with its safety argument written down. Mark-of-the-Web is applied on extract by default, in the GUI and the command line.
This is pre-release software under active adversarial review. We publish the limits as loudly as the wins, and the review record along with them.
Context
Born in 2026, not 1993.
The pieces have existed for years — zstd, Argon2, BLAKE3, FastCDC. Nobody had assembled them into an archiver for people who have to prove their files. So a nonprofit did.
Measured, not marketed
The corpus is in the repository. Re-run it yourself.
Fifteen catalog files, 3,693,354 bytes, spanning text, CSV, JSON, logs, source, raw and compressed images, and random bytes. Every file came back byte for byte.
| Format | Archive size | Compared with ZIP 9 |
|---|---|---|
| ZIP 9 (Z501 writer, DEFLATE + auto-STORE) | 1,919,125 | baseline |
| Z501 per-chunk default (zstd 5) | 1,885,332 | 1.76% smaller |
| Z501 solid (zstd 19) | 1,856,946 | 3.24% smaller |
| Z501 tar.zst 19 | 1,853,875 | 3.40% smaller |
7-Zip 21.07 -mx9 solid | 1,836,423 | 4.31% smaller — smallest on this set |
xz 5.8.3 -9e | 1,839,724 | 4.14% smaller |
RAR 7.20 -m5 | 1,871,020 | 2.51% smaller |
How to read that
Almost half of this corpus — 1,785,880 bytes, or 48.35% — cannot shrink at all. It is random data, JPEG and PNG. No archiver can invent space there, so every tool leaves it alone and they all finish within a few percent of each other. The interesting number is the other half: 1,907,474 bytes of text, CSV, JSON, logs and source became 90,199 bytes of zstd frames, about 21:1 on the part that can shrink.
If your folder is documents, logs and source, you will see the 21:1 side. If it is photos and already-zipped files, you will see the brick. That is physics, not a missing slider — and it is why the reason to use Z501 is lock, seal and prove, not a size race.
Reproduce it: cargo test --release --features production-scale --test bench_corpus -- --nocapture --test-threads=1 · Release run 2026-09-06. ZIP, solid and tar.zst from the Z501 writer; 7-Zip, RAR and xz run against the same catalog files.
Questions
The six we get asked most.
Is it really free?
Yes, and every shipped feature is included. There is no trial, no licence key, no advertising, no trackers and no telemetry. If you donate to Veteran Fathers 501 you can record an Honor or Verified marker in your local settings; it is recognition, and it turns nothing on or off.
Why should I trust a 0.1 release with evidence?
You should not, yet. It is pre-release and it says so on every page. Use it on copies, run your own verification, and read the security record. The point of publishing early is that you can check the work before anyone asks you to rely on it.
Why AGPL and not MIT?
It keeps derivatives open. Every feature is free either way, and the bundled UnRAR component stays under its own separate licence, which forbids using that source to rebuild the RAR compressor. Z501 only opens rar files; it never writes them.
Does it replace my imager?
No. Z501 is a logical evidence archive, comparable in purpose to an L01 or AD1. Image the drive with your imager. Move and prove the file set with Z501.
Why does Windows warn me when I install it?
Because the installer is not signed yet. An EV code-signing certificate is a 1.0 item. Until then the published SHA-256 above is how you confirm you have the file we built.
Where do donations go?
Directly to the Foundation for Parental Rights for Veteran Fathers, on the charity's own donation page. Intersec Worldwide receives no part of any donation.
